CVSS severity score
A score from 0 to 10 for how bad a flaw could be if attacked. It measures potential damage, not whether anyone is attacking it.
CVSS, the Common Vulnerability Scoring System, rates flaws on things like whether an attacker needs a password, whether they can attack over the internet, and how much damage they could do. Scores of 9 and above are called critical.
The catch: plenty of 9.8 "critical" flaws are never exploited, while some 6-point flaws are used in major attacks. Severity tells you how bad it could be; it doesn't tell you how likely it is.
Why it matters to you: Don't patch by severity score alone. Put flaws that are actually being exploited first, then use the score to order the rest.
Related terms
- EPSS (exploit prediction score)A daily estimate, from 0% to 100%, of how likely a flaw is to be exploited in the next 30 days.
- Exploited vulnerabilityA software flaw that attackers are actually using in real attacks, not just one that could be used in theory.
- CVE numberThe ID number that identifies one specific security flaw, like CVE-2026-41709.